KernelEx 2022 (Kex22) Test Versions (4.22.26.2)

[MiKl]

@ Jumper, about the list of files from post 232 - should I also disable KernelEx on LZ32.dll ?? Kext re-directs to this dll, isn't it ?

 

Update:

Posting now from my AMD Athlon/Via machine and I think I made some progress.

With full v11 I still get the runonce error.

 

Datum 01/22/2016 Uhrzeit 14:10
RUNONCE verursachte einen Fehler durch eine ungültige Seite
in Modul KERNEL32.DLL bei 018f:bff741ca.
Register:
EAX=e914ec50 CS=018f EIP=bff741ca EFLGS=00010202
EBX=822d58fc SS=0197 ESP=0063fadc EBP=0063fb08
ECX=7d00b90d DS=0197 ESI=000088ae FS=3ecf
EDX=00000000 ES=0197 EDI=00000094 GS=0000
Bytes bei CS:EIP:
ff 4a 10 75 08 89 42 08 ff 42 04 90 c3 39 42 08
Stapelwerte:
7d00b90d 00000094 000088ae 822d58fc 7c039760 ffffffff 7c00249e 7c002465 00000000 00000fa0 822d5710 0063fbb0 7c002e15 7c002cb5 00000094 00000004

 

But after clicking OK I now reach desktop and some of the kernelex-apps like Sunbird work, while others like SeaMonkey do not.

 

Datum 01/22/2016 Uhrzeit 14:11
SEAMONKEY verursachte einen Fehler durch eine ungültige Seite
in Modul KERNEL32.DLL bei 018f:bff7b9a6.
Register:
EAX=00000000 CS=018f EIP=bff7b9a6 EFLGS=00000246
EBX=82305188 SS=0197 ESP=00a7fa6c EBP=00a7fa7c
ECX=ffffffff DS=0197 ESI=7d019a80 FS=5abf
EDX=823059c0 ES=0197 EDI=00000094 GS=0000
Bytes bei CS:EIP:
ff 76 04 e8 13 89 ff ff 5e c2 04 00 56 8b 74 24
Stapelwerte:
000088ae 7d0066aa 7d019a80 ffffffff 00a7fa94 7d0065f0 00000142 00000000 00000000 00000000 00a7fab4 7d0021c4 00000142 00000000 00000000 00000000

 

Update 2: On my 'best' system (P4/ICH6R) v11 seem to work perfectly. SeaMonkey 2.7.x. and 2.8. are running much longer now (several minutes) before the freezings happen.

SeaMonkey 2.9. still freezes almost immediately.

Edited January 23, 2016 by MiKl

[Dave-H]

Sorry @jumper, the 2015.11 update has caused me more problems I'm afraid.

 

I have a shortcut which runs a .vbs file to prompt me as to whether or not I want to run a mirror program (QuickMirror) to backup my system drives under 98SE. If I click "yes" on the message box prompt it runs it, if I click "no" it doesn't. this is to prevent it being run accidentally.

It has always worked fine until I applied the 2015.11 registry fix.

 

Suddenly running the shortcut just produced a message saying that QuickMirror needs a later version of Windows (it doesn't).

I assumed this was because wscript.exe was now having the wrong KernelEx settings applied to it as it's in the Windows\System folder.

 

I tried changing the KernelEx settings on wscript.exe, but every setting I tried either made no difference, or caused the shortcut to immediately run the program without the prompt, which is useless.

 

I then tried moving wscript.exe to the Windows folder and changing the folder options to reflect this, and the shortcut also then worked but again immediately just ran the QuickMirror program without prompting me as to whether I wanted to or not, so that was no good either.

 

I could find no way of resolving this, so I'm back on 2015.10 I'm afraid.

After reinstalling that and putting everything else back as it was, everything now works as it should.

 

Any idea how I can resolve this problem?

Cheers, Dave.

Edited January 23, 2016 by Dave-H

[jumper]

@Mikl

Yes, disable KernelEx extensions on Lz32.dll. Disabling prevents a DLL from using Kex, not Kex from using the DLL.

Use the registry patch to quickly and completely disable KernelEx on all system DLL's. That should eliminate the Runonce error.

Once you reach the desktop, check the loaded module list for Mprexe in a process viewer such as ProcWin and see if KernelEx, Kexbasen, Kexbases, and Kstub822 are all loaded. If one is not, apps that need it will not work.

@Dave-H

QuickMirror 1.32 is an XP app, so set its mode to 2K or XP. Despite their claims to still support Win9x, Dependency Walker shows the required subsystem on mirror.exe as 5.1 and also shows unresolved dependencies in Kernel32 and Shell32 on my 98se system. QM1.32 also bundles an old version of Unicows.dll, so you may want to delete it.

Wscript.exe should be in the Windows folder, but if your scripts work best with it in System then leave it there. This Wscript.exe placement issue is most likely unrelated to the problem at hand or KernelEx in general. Unfortunately, you can't check "Don't use these settings in child processes" on it, so you'll have to manually enable KernelEx on any apps such as QuickMirror that require it and are invoked by script.

[Dave-H]

Thanks @jumper!

Strange what you say about QuickMirror as I've been using it for many years on 98SE, I would have thought even before i had KernelEx installed, but it may have been an earlier version back then of course.

When the recent problem was there, it still ran fine when run directly, but didn't when run through the vbs shortcut, which is why I assumed that the problem was actually with wscript, not with QuickMirror.

Wscript.exe has always been in my windows\system folder AFAIK. Interesting that you say it should be in the \windows folder, but as I said, moving it made the Windows version error go away, but the shortcut still didn't work properly, bypassing the "are you sure" prompt part of the script.

I will try your suggestions and report back.

Cheers, Dave.

[DougB]

Ok... my first glitch after the Release-11 fix:

  VLC media player could not start.  Either the command line options were invalid or no plugins were found.

No info was written to Faultlog.txt file.  

I haven't changed anything regarding VLC, same behavior occurs on two separate systems, behavior unchanged after reverting back to Release 10.  I'm using VLC v2.1.5 (last ver that could play DVDs for me).  

- Doug B.

P.S. To clarify a point in my previous post (#254): At some point, Audacity did require KExt, now it runs with straight KEx. 

[jumper]

Sounds like you have a DLL in System that needs KernelEx enabled. The message is from VLC, not the OS, so VLC does in fact start to start.

Try profiling it in Depends to see what delay-loads might be failing. Also, "Use API Hook" and then "Output to log file" in KernelEx ApiLog Console (DebugWindow.exe) to see what modules KernelEx is loading. (Install the ApiHook "Extra" into KernelEx folder if you haven't already.)

Kexstubs is a method for users to create and test their own new stubs. It was always meant for the best stubs to be migrated into KernelEx's base offerings. I am now doing that.

[MiKl]

I have the same problem with VLC on the system where v11 works !! On the other one using kexbasen v10 VLC still runs fine. On both systems the recommended changes from post 232 had been done .... strange.

 

After re-enabling ole32.dll for KernelEx there actually is a error message:

 

Datum 01/24/2016 Uhrzeit 14:13
VLC verursachte einen Fehler durch eine ungültige Seite
in Modul KERNEL32.DLL bei 017f:bff741ca.
Register:
EAX=c22bd060 CS=017f EIP=bff741ca EFLGS=00010202
EBX=9287496c SS=0187 ESP=0076fadc EBP=0076fb08
ECX=7d00b90d DS=0187 ESI=00000893 FS=3367
EDX=00000000 ES=0187 EDI=00000094 GS=0000
Bytes bei CS:EIP:
ff 4a 10 75 08 89 42 08 ff 42 04 90 c3 39 42 08
Stapelwerte:
7d00b90d 00000094 00000893 9287496c 7c039760 ffffffff 7c00249e 7c002465 00000000 00000fa0 92884998 0076fbb0 7c002e15 7c002cb5 00000094 00000005

 

Update: I was finally able to get v11 working on the above mentioned AMD/VIA machine but unfortunately all of the kernelex-apps refused to work except Sunbird because this one seem to load only kexcom.dll.

 

But - I played around a little bit and when kex is deactivated on msvcrt.dll (renamed msvcr70.dll 7.00.9981.0)

apps like Notepad++ 'crash' on start but load and run fine anyway ! The same happens on SumatraPDF, OpenOffice, etc.

Only VLC stubbornly still refuses to run. Hope this observation helps a little ...

 

@DougB: Please check the comp-mode of msvcrt.dll when back at v10.

 

@Jumper: When checking kexbasen.dll with DependecyWalker it reports a missing dll named certcli.dll. Should this one be added ?

Edited January 24, 2016 by MiKl

[jumper]

My Ole32.dll is 98se stock 4.71.2900. Yours?

No version of Ke*.dll is dependent on Certcli.dll. In DW find the module reference in the tree and report the modules (and their versions) above it. Is it a delay-load (hour glass)?

Edited January 25, 2016 by jumper

[MiKl]

My Ole32.dll is 98se stock 4.71.2900. Yours?

No version of Ke*.dll is dependent on Certcli.dll. In DW find the module reference in the tree and report the modules (and their versions) above it. Is it a delay-load (hour glass)?

 

I am using ME's Ole32.dll (4.71.3328).

 

There is indeed the hour-glass symbol on Certcli.dll ! I have made a screenshot but I am not sure how to upload it

or can I just email it to you ?

I am not sure if I understood you correctly, but here we go:

- above certcli.dll  is  wintrust.dll (5.131.1880.14, no hour glass, kex disabled).

- above wintrust.dll  is  cryptui.dll  (5.131.1878.14, hour glass, kex disabled)

- above is kexbasen.dll

Edited January 25, 2016 by MiKl

[jumper]

I see it now:

Kexbasen.dll -> Cryptui.dll -> Certcli.dll

I have Certcli.dll forwarded to Lz32.dll via KnownDLLs so DW shows me:

Kexbasen.dll -> Cryptui.dll -> Lz32.dll

I haven't written any stubs to go with the forward yet, so if you can find a Certcli.dll that will work with KernelEx, that would be great.

[loblo]

VLC does not need certcli.dll.  I don't have this dll and VLC (2.2.2.0) runs fine on my system.

[Dave-H]

@jumper

I've been experimenting trying to get my script to work when KEx 2015.11 is installed, but no luck as yet.

QuickMirror runs fine with the default KernelEx setting, both directly and by using shortcuts, included saved mirror configuration files that are associated with it. My script simply calls one of those mirror files, once you've answered "yes" to a yes/no prompt. If you answer "no" the script just terminates.

The script is as follows -

On error resume nextcompstr = wscript.arguments(0)verify = MsgBox("Run QuickMirror System Backup to Drive F:?",vbYesNo, "Confirm")If verify = vbNo Then wscript.quitEnd IfSet objShell = WScript.CreateObject( "WScript.Shell" )objShell.Run("""C:\Utilities\QuickMirror\System Backup to Drive F.mir""")Set objShell = Nothing

Is there anything wrong there, anyone that knows about scripting?

 

This script works fine when run from a shortcut with KEx 2015.10 installed, but with 2015.11 installed with the registry fix I just get the message about mirror.exe needing a later version of Windows. If I play with the KEx settings on mirror.exe, and/or on wscript.exe I either get the same result, or the mirror just immediately runs without showing the yes/no prompt message box!

 

The fact that it's not showing the prompt message box would indicate to me that it's wscript.exe that's the problem, not mirror.exe.

It should show the message box before even attempting to run QuickMirror of course.

 

I've tried moving wscript.exe out of the \system folder to the \windows folder, which made no difference, but I assume the wscript dlls are still in the system folder, which may be the problem.

I'm using the Unofficial Windows Script 5.7.0.20550 update BTW, if that makes any difference.

Edited January 25, 2016 by Dave-H

[jumper]

I see three distinct problems:

1) script does not display MsgBox

2) script calls mirror file without answer "yes"

3) mirror.exe needs later version of Windows

Working backwards:

3) mirror.exe needs to be set to XP mode to be immune to how it is invoked.

2) The script...

You want: My script simply calls one of those mirror files, once you've answered "yes" to a yes/no prompt.

You programmed: If you answer "no" the script just terminates.

These are not the same thing. Try this script:

On error resume nextcompstr = wscript.arguments(0)verify = MsgBox("Run QuickMirror System Backup to Drive F:?",vbYesNo, "Confirm")If verify = vbYes Then Set objShell = WScript.CreateObject( "WScript.Shell" ) objShell.Run("""C:\Utilities\QuickMirror\System Backup to Drive F.mir""") Set objShell = NothingEnd If

The .mir will only be launched if the MsgBox appears and is answered "yes".

1) Why the MsgBox doesn't display is still a mystery, but could be because an error (at bff741ca?) occurs that is handled by wscript instead of crashing. Remove "On error resume next" and see it this exposes a crash.

[Dave-H]

Thanks again @jumper.

I'll check all that out and get back to you.

 

I am just wondering, presumably the files that have a problem with 2015.11 are some system files in the \system folder.

Is it really necessary to do a blanket disable of KernelEx on all the files in the folder to fix this?

The problem with that is that the registry entry over-rides everything else, and you can't re-enable KernelEx on individual files.

This is awkward if disabling KernelEx causes problems with some applications, as people have already found with VLC and my problems, which must be caused by this. Is there no hope of finding out exactly what system files have the problem and stop the desktop loading, and just disabling KernelEx on those?

[Dave-H]

OK, back again!

I've got the scripting working again.

I had to move all the related files out of the \system folder into the \windows folder, and edit all the registry entries to reflect this.

It then worked fine!

 

Incidentally it's the Unofficial Windows Script 5.7.0.20550 update installer that puts wscript.exe and cscript.exe in the \system folder, which is not where the original Windows 98 installer puts them.

I think whoever compiled the INF file got things confused with the NT install, which puts both those files in the \system32 folder.

 

Anyway, after moving them to the \windows folder, along with their associated dlls, it all came good.

I am going to keep your version of the script @jumper, as it looks neater!